CVE-2023-35078: Ivanti EPMM Auth Bypass — Emergency Detection and Patching Guide

---
title: Ivanti EPMM Java Process Spawning Shell - Potential RCE
id: 9a3b1c82-8e4b-4d67-bc12-3e5a8f90d44e
status: experimental
description: Detects the Ivanti EPMM (MobileIron) Java/Tomcat process spawning a shell. This is a high-fidelity indicator of successful remote code execution following CVE-2023-35078 exploitation.
references:
  - https://www.ivanti.com/blog/cve-2023-35078
author: Security Arsenal
date: 2023/08/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains:
      - 'mobileiron'
      - 'ivanti'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/bin/sh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative troubleshooting by system admins (rare)
level: critical
---
title: Suspicious Access to Ivanti EPMM /mics/ API Endpoint
id: b4c2e910-1d3f-4a5b-9c8e-7f6a5b4c3d2e
status: experimental
description: Detects unauthenticated or suspicious access to the /mics/ services endpoint, indicative of CVE-2023-35078 auth bypass attempts. Note: Requires Network or Proxy logs.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2023/08/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: nginx
detection:
  selection_uri:
    cs-uri-query|contains: '/mics/services/'
  selection_method:
    cs-method: 'POST'
  filter_auth:
    cs-cookie|contains: 'MISSION' # Legitimate sessions often use specific cookie names; adjust based on local config
  condition: selection_uri and selection_method and not filter_auth
falsepositives:
  - Legacy integrations using hard-coded credentials (if cookie check is too strict)
level: high

// Hunt for CVE-2023-35078: Auth bypass on /mics/ endpoints
CommonSecurityLog
| where DeviceVendor in ("Ivanti", "MobileIron") or DeviceProduct contains "EPMM"
| where RequestURL contains "/mics/services/"
| extend Reason = coalesce(Reason, "")
| where Reason !contains "authenticated" // Filter if your logs tag authenticated requests
| where RequestURL contains "MICS" // Specific vulnerable component
| project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, RequestURL, RequestMethod, Activity, DeviceAction
| order by TimeGenerated desc

-- Hunt for Ivanti EPMM Exploitation Indicators
SELECT Pid, Name, Exe, CommandLine, Username, Ctime
FROM pslist()
WHERE Name = 'java'
  AND (
    CommandLine =~ 'mobileiron' 
    OR CommandLine =~ 'ivanti'
    OR CommandLine =~ 'mics'
  )

-- Look for recent shell executions that might be children of the web service
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name IN ('bash', 'sh', 'dash', 'zsh')
  AND Ppid IN (
    SELECT Pid 
    FROM pslist() 
    WHERE Name = 'java' AND (CommandLine =~ 'mobileiron' OR CommandLine =~ 'ivanti')
  )

#!/bin/bash
# Emergency Remediation Script for CVE-2023-35078 (Ivanti EPMM)
# Run this as root on the EPMM appliance to verify version and restrict access.

echo "[*] Checking Ivanti EPMM Version..."

# Check version (Adapt path if necessary for specific install location)
if [ -f "/usr/local/MobileIron/version.txt" ]; then
    cat /usr/local/MobileIron/version.txt
else
    echo "[!] Version file not found at /usr/local/MobileIron/version.txt"
fi

echo "[*] Checking for vulnerable configuration in web.xml..."
# Note: This is a heuristic check. Consult the official advisory for exact patch numbers.
grep -r "mics" /usr/local/MobileIron/core/installed/ 2>/dev/null | head -n 5

echo "[*] Emergency Mitigation: Blocking external access to /mics/ via iptables (unless patched)"
# WARNING: Verify this rule does not break legitimate MDM traffic before applying in production.
# This assumes the management interface is on eth0. Adjust interface as needed.
# iptables -I INPUT -p tcp --dport 443 -m string --string "/mics/" --algo bm -j DROP
# iptables -I INPUT -p tcp --dport 8443 -m string --string "/mics/" --algo bm -j DROP

echo "[+] ACTION REQUIRED: Update to Ivanti EPMM versions:"
echo "    - 11.4.x (Build 1120+)
    - 11.9.x (Build 1120+)
    - 12.0.x (Build 1120+)
    - 12.1.x (Build 1108+)
    - 12.2.x (Build 1112+)"
echo "Refer to: https://www.ivanti.com/blog/cve-2023-35078"